Analysis
-
max time kernel
186s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:10
Static task
static1
Behavioral task
behavioral1
Sample
41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe
Resource
win7-20221111-en
General
-
Target
41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe
-
Size
330KB
-
MD5
a65c9ea6312480a25af1519d2fe7f8ca
-
SHA1
7f77406aea3f87807fab080e140b93fd0d2b9a19
-
SHA256
41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5
-
SHA512
e481484cac7b4df4b1ca4ff02b5bfe43a5a029bdaf193a8822c6db4676e1cdb0c5123d803249e5215e2e1f4f379cb5b6619201d387d8a5394279a378be21fead
-
SSDEEP
3072:Pd40HStXd+Yy7XCQW4rKMXxgT1uyIdxOnvluXMp3cKAArDZz4N9GhbkUNEkoXe:Pd2dhAKCxgA3o9ucpxyN90vE1e
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
shaderturned.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat shaderturned.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
shaderturned.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-83-56-8d-13-6a\WpadDecisionTime = 90fee0467c06d901 shaderturned.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-83-56-8d-13-6a\WpadDecision = "0" shaderturned.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings shaderturned.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 shaderturned.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5} shaderturned.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}\WpadDecision = "0" shaderturned.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}\WpadNetworkName = "Network 2" shaderturned.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}\06-83-56-8d-13-6a shaderturned.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings shaderturned.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections shaderturned.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix shaderturned.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad shaderturned.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 shaderturned.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-83-56-8d-13-6a\WpadDecisionReason = "1" shaderturned.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" shaderturned.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" shaderturned.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}\WpadDecisionReason = "1" shaderturned.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-83-56-8d-13-6a shaderturned.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 shaderturned.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" shaderturned.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}\WpadDecisionTime = 90fee0467c06d901 shaderturned.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exeshaderturned.exeshaderturned.exepid process 1140 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe 852 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe 572 shaderturned.exe 944 shaderturned.exe 944 shaderturned.exe 944 shaderturned.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exepid process 852 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exeshaderturned.exeshaderturned.exepid process 1140 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe 852 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe 572 shaderturned.exe 944 shaderturned.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exeshaderturned.exedescription pid process target process PID 1140 wrote to memory of 852 1140 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe PID 1140 wrote to memory of 852 1140 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe PID 1140 wrote to memory of 852 1140 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe PID 1140 wrote to memory of 852 1140 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe 41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe PID 572 wrote to memory of 944 572 shaderturned.exe shaderturned.exe PID 572 wrote to memory of 944 572 shaderturned.exe shaderturned.exe PID 572 wrote to memory of 944 572 shaderturned.exe shaderturned.exe PID 572 wrote to memory of 944 572 shaderturned.exe shaderturned.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe"C:\Users\Admin\AppData\Local\Temp\41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe"C:\Users\Admin\AppData\Local\Temp\41e757e16ac12eb0d9995efb6c0593b4a34aa4562aec7451bfe5d6fdf5c465d5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\shaderturned.exe"C:\Windows\SysWOW64\shaderturned.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shaderturned.exe"C:\Windows\SysWOW64\shaderturned.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-55-0x0000000000000000-mapping.dmp
-
memory/852-58-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/852-59-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/852-60-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/852-62-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/944-61-0x0000000000000000-mapping.dmp
-
memory/1140-54-0x0000000000220000-0x0000000000232000-memory.dmpFilesize
72KB
-
memory/1140-56-0x0000000000220000-0x0000000000232000-memory.dmpFilesize
72KB
-
memory/1140-57-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB